CVE-2026-43961

A flaw was found in Vim's netrw plugin. A crafted filename containing quote characters and expression fragments can break out of the quoted context during mark/unmark operations, allowing arbitrary Vimscript execution. This can be leveraged to run shell commands with the privileges of the user...

vim: Vim: Arbitrary Code Execution via crafted directory names

A flaw was found in Vim, an open-source text editor. This vulnerability, located in the netrw plugin, involves a code injection issue when the editor processes directory paths. A malicious directory name, if crafted by an attacker, could bypass security measures and allow for the execution of...

SUSE CVE-2026-73078

Vim is an open source, command line text editor. Prior to 9.2.0840, runtime/plugin/netrwPlugin.vim loads netrw and runtime/pack/dist/opt/netrw/autoload/netrw.vim constructs Bookmarks, History, and Targets menu entries by interpolating attacker-controlled directory paths into executed :menu...

CVE-2026-73078

A flaw in Vim's netrw plugin fails to sanitize special characters in directory paths when creating GUI menu entries. Browsing or bookmarking a maliciously crafted path in GUI Vim allows attackers to execute arbitrary OS commands as the running user. Mitigation To mitigate this issue, avoid browsi...

Security Bulletin: Vulnerabilities exists in IBM Netezza Software

Summary Vulnerabilities identified in IBM Netezza Software have been addressed in version 1.0.2.0 Vulnerability Details CVEID:CVE-2026-47162 DESCRIPTION: Vim is an open source, command line text editor. Prior to version 9.2.0495, a Vimscript code injection vulnerability exists in...

Linux Distros Unpatched Vulnerability : CVE-2026-73078

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Vim is an open source, command line text editor. Prior to 9.2.0840, runtime/plugin/netrwPlugin.vim loads netrw and runtime/pack/dist/opt/netrw/autoload/netrw.vi...

AZL-95550 CVE-2026-73078 affecting package vim for versions less than 9.2.0957-1

Vim is an open source, command line text editor. Prior to 9.2.0840, runtime/plugin/netrwPlugin.vim loads netrw and runtime/pack/dist/opt/netrw/autoload/netrw.vim constructs Bookmarks, History, and Targets menu entries by interpolating attacker-controlled directory paths into executed :menu...

CVE-2026-73078

Vim is an open source, command line text editor. Prior to 9.2.0840, runtime/plugin/netrwPlugin.vim loads netrw and runtime/pack/dist/opt/netrw/autoload/netrw.vim constructs Bookmarks, History, and Targets menu entries by interpolating attacker-controlled directory paths into executed :menu...

CVE-2026-73078

Vim is an open source, command line text editor. Prior to 9.2.0840, runtime/plugin/netrwPlugin.vim loads netrw and runtime/pack/dist/opt/netrw/autoload/netrw.vim constructs Bookmarks, History, and Targets menu entries by interpolating attacker-controlled directory paths into executed :menu...

CVE-2026-73078 Vim: Arbitrary Code Execution via Netrw Menu Construction

Vim is an open source, command line text editor. Prior to 9.2.0840, runtime/plugin/netrwPlugin.vim loads netrw and runtime/pack/dist/opt/netrw/autoload/netrw.vim constructs Bookmarks, History, and Targets menu entries by interpolating attacker-controlled directory paths into executed :menu...

EUVD-2026-56234

Vim is an open source, command line text editor. Prior to 9.2.0840, runtime/plugin/netrwPlugin.vim loads netrw and runtime/pack/dist/opt/netrw/autoload/netrw.vim constructs Bookmarks, History, and Targets menu entries by interpolating attacker-controlled directory paths into executed :menu...

CVE-2026-73078

Vim (open source editor) firmware prior to 9.2.0840 is vulnerable via the netrw menu construction. The vulnerability arises when netrwPlugin.vim loads netrw and autoload/netrw.vim builds Bookmarks, History, and Targets menu entries by interpolating attacker-controlled directory paths into :menu c...

PT-2026-70268

Name of the Vulnerable Software and Affected Versions Vim versions prior to 9.2.0840 Description In GUI Vim, the runtime/plugin/netrwPlugin.vim loads netrw, and runtime/pack/dist/opt/netrw/autoload/netrw.vim creates Bookmarks, History, and Targets menu entries. The process interpolates...

EulerOS 2.0 SP11 : vim (EulerOS-SA-2026-3163)

According to the versions of the vim packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : Vim is an open source, command line text editor. Prior to version 9.2.0495, a Vimscript code injection vulnerability exists in s:NetrwBookHistSave in...

K000162711: Vim vulnerability CVE-2026-28417

Security Advisory Description Vim is an open source, command line text editor. Prior to version 9.2.0073, an OS command injection vulnerability exists in the netrw standard plugin bundled with Vim. By inducing a user to open a crafted URL e.g., using the scp:// protocol handler, an attacker can...

Amazon Linux 2 : vim, --advisory ALAS2-2026-3804 (ALAS-2026-3804)

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2-2026-3804 advisory. Vim is an open source, command line text editor. Prior to 9.2.0653, the treecountwords function in src/spellfile.c fills in the word-count fields of a spell-file word trie by walking it iterative...

Important: vim

Issue Overview: Vim is an open source, command line text editor. Prior to 9.2.0653, the treecountwords function in src/spellfile.c fills in the word-count fields of a spell-file word trie by walking it iteratively with a depth counter. The counter is bounded only by the trie structure itself; it ...

Oracle Linux 10 : vim (ELSA-2026-19073)

The remote Oracle Linux 10 host has packages installed that are affected by a vulnerability as referenced in the ELSA-2026-19073 advisory. - RHEL-159616 CVE-2026-33412 vim: Vim: Arbitrary code execution via command injection in glob function - RHEL-155410 CVE-2026-28421 vim: Vim: Denial of servic...

vim: Vim: Arbitrary Code Execution via crafted directory names

A flaw was found in Vim, an open-source text editor. This vulnerability, located in the netrw plugin, involves a code injection issue when the editor processes directory paths. A malicious directory name, if crafted by an attacker, could bypass security measures and allow for the execution of...

vim: Vim: Arbitrary Code Execution via crafted directory names

A flaw was found in Vim, an open-source text editor. This vulnerability, located in the netrw plugin, involves a code injection issue when the editor processes directory paths. A malicious directory name, if crafted by an attacker, could bypass security measures and allow for the execution of...